Knowledge Management

Priority and editing of local.meta/default.meta

fatsug
Contributor

Hello everyone

Two parter. First of all, am I correct in assuming that

/appname/metadata/local.meta

takes precedence over

/appname/metadata/local.meta

The reason for this question is that while applying changes in a SH cluster from a deployer, changes made to default.meta in an app has no effect and changes in local.meta are retained.

Second, what is the best praxis for editing the local.meta file? I think I, at least, need to completely remove the read/write permissions so it falls back on the default.meta file

[]
access = read : [  ], write : [  ]
export = none
version = x.x.x.x
modtime = tttttttttt.tttttttt

Otherwise any future edits made and rolled out will not take effect as there is a local.meta file. Though I was hoping that I could just delete the entire local.meta file?

To be clear, the actual question, can I

    a) delete the entire local.meta file or do I have to

    b) edit out the desired section in the local.meta file?

I know I can edit access to alerts/dashboards etc via the GUI though I'd like to edit for everything in the app in one single move from the CLI.

All the best

// f

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You are correct; local.meta trumps default.meta for a given app.  To get the default.meta to take effect again, the local.meta stanza or file must be removed.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You are correct; local.meta trumps default.meta for a given app.  To get the default.meta to take effect again, the local.meta stanza or file must be removed.

---
If this reply helps you, Karma would be appreciated.

fatsug
Contributor

And just to make sure, there is no problem just removing the file?

I assume that you first check for any local changes you want to remain, but otherwise you can just delete the file and move on?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

No problem just removing .meta files.

Correct.

---
If this reply helps you, Karma would be appreciated.

fatsug
Contributor

Schweet, thanx!

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...
OSZAR »